CVE-2026-0498: SAP S/4HANA RCE Vulnerability

CVE-2026-0498 Overview

CVE-2026-0498 affects SAP S/4HANA (Private Cloud and On-Premise) deployments. The vulnerability resides in a function module exposed via Remote Function Call (RFC). An authenticated attacker with administrative privileges can inject arbitrary ABAP code or operating system commands. The flaw bypasses essential authorization checks and effectively operates as a backdoor.

Successful exploitation compromises the confidentiality, integrity, and availability of the SAP system. The vulnerability is classified as [CWE-94] Improper Control of Generation of Code (Code Injection). SAP released a fix through SAP Note #3694242 as part of its Security Patch Day.

Critical Impact
Attackers with admin RFC access can execute arbitrary ABAP and OS commands, leading to full SAP S/4HANA system compromise.

Affected Products

SAP S/4HANA (Private Cloud and On-Premise) versions 102 through 109
All deployments exposing the affected RFC function module
Both on-premise and private cloud installations are in scope

Discovery Timeline

2026-01-13 - CVE-2026-0498 published to NVD
2026-01-13 - SAP releases security patch via SAP Note #3694242 on Security Patch Day
2026-01-22 - Last updated in NVD database

Technical Details for CVE-2026-0498

Vulnerability Analysis

The vulnerability is a code injection flaw in a function module exposed through SAP's Remote Function Call (RFC) interface. RFC is the standard SAP protocol used for cross-system communication between SAP application servers and external systems. The affected function module accepts input that is later evaluated as ABAP code or executed as operating system commands without sufficient validation.

The issue is compounded by missing authorization checks. Even though SAP enforces granular authority checks across business transactions, this specific module fails to validate that the caller is authorized for the requested operation. An attacker who holds administrative credentials can therefore reach the function module remotely and trigger arbitrary code execution on the SAP host.

The attack chain is fully network-reachable. Once executed, injected ABAP runs with the privileges of the SAP work process, while injected OS commands run with the privileges of the <sid>adm user that owns the SAP kernel. Both vectors yield complete control over SAP business data and the underlying host operating system.

Root Cause

The root cause is improper neutralization of input passed to dynamic ABAP statements or shell execution within the RFC-exposed function module. Combined with a missing authorization check, the design allows administrative callers to escape the intended functional scope of the module.

Attack Vector

An attacker authenticates to SAP S/4HANA using high-privilege administrative credentials and invokes the vulnerable RFC function module across the network. Crafted parameters are interpreted as ABAP source or shell input. The injected payload then executes inside the SAP kernel process, providing read/write access to all database tables, configuration, and the host filesystem.

No verified public exploit code is available at this time. Technical specifics are restricted to authorized SAP customers through SAP Note #3694242. Refer to the SAP Note #3694242 for vendor-supplied technical details.

Detection Methods for CVE-2026-0498

Indicators of Compromise

Unexpected RFC calls to administrative or non-business function modules originating from unusual source systems or IP ranges
New or modified ABAP reports, function modules, or transport requests created outside of standard change-management windows
OS-level processes spawned by the <sid>adm user that do not match normal SAP kernel activity
Creation of new SAP users with SAP_ALL or equivalent broad authorizations following RFC traffic spikes

Detection Strategies

Enable and review SAP Security Audit Log (SM19/RSAU_CONFIG) for RFC function calls performed by administrative accounts
Monitor the Gateway Logs and RFC trace for invocations of function modules that are not part of documented integrations
Correlate SAP application logs with host-level process telemetry to surface ABAP-initiated OS command execution
Baseline normal RFC traffic and alert on deviations, especially calls to dynamic-code-capable modules

Monitoring Recommendations

Forward SAP audit logs, Gateway logs, and host process telemetry into a centralized SIEM for cross-source correlation
Track changes to ABAP repository objects (SE80, SE38) and transport activity in production systems
Alert on creation or modification of users with administrative roles after suspicious RFC activity

How to Mitigate CVE-2026-0498

Immediate Actions Required

Apply the fix delivered in SAP Note #3694242 to all SAP S/4HANA systems running releases 102 through 109
Audit administrative accounts and rotate credentials for any user with S_RFC authorization on the affected module
Restrict RFC access to known trusted source systems using the SAP Gateway access control lists (secinfo, reginfo)
Review recent Security Audit Log entries for signs of pre-patch exploitation

Patch Information

SAP published the security fix on Security Patch Day. Customers must download and apply SAP Note #3694242 through the SAP ONE Support Launchpad. See the SAP Security Patch Day Announcement and the SAP Note #3694242 for installation guidance and prerequisites.

Workarounds

Remove or tightly restrict the S_RFC authorization object on the affected function module/group for non-essential administrators
Configure SAP Gateway ACLs (secinfo, reginfo) to limit which hosts may register and invoke RFC destinations
Enforce Unified Connectivity (UCON) to allow only explicitly approved RFC function modules to be called from external systems

bash

# Example SAP Gateway reginfo restriction (illustrative)
# /usr/sap/<SID>/SYS/profile/reginfo
P TP=* HOST=internal-trusted-host ACCESS=internal-trusted-host CANCEL=internal-trusted-host
D TP=* HOST=* ACCESS=* CANCEL=*